\section{Overview}

Based on the architecture of the public cloud, virtualization 
abstracts the underlying details, cloud tenants
lack the necessary visibility to perform troubleshooting. More
specifically, tenants only have access to their own virtual resources,
and, crucially, each virtual resource may map to multiple physical
resources, i.e., a virtual link may map to multiple 
physical links.  When a problem arises, there is no way today to
systematically obtain the relevant data from the appropriate 
locations and expose them to the tenant in a meaningful way to
facilitate diagnosis.


In this chapter, we make the case for APLAD, a Application PLAne Diagnostic
framework that enables a
cloud provider to offer sophisticated virtual network diagnosis
to its tenants as a service. Extracting the relevant data and exposing it
to the tenant forms the basis for APLAD. Yet, this is not trivial
because several requirements must be met when extracting and exposing the
data: we must preserve the abstracted view that the tenant is operating
on, ensure that data gathering and transfer do not impact performance
of ongoing connections, preserve isolation across tenants, and enable
suitable analysis to be run on the data, 
while scaling to large numbers of tenants in a cloud.

APLAD exposes interfaces for configuring diagnosis and querying traffic
traces to cloud tenants for troubleshooting their virtual
networks. Tenants can specify a set of flows to monitor, and
investigate network problems by querying {\em their own} traffic
traces. APLAD controls the appropriate software switches to collect flow
traces and distributes traffic traces of different tenants into
``table servers''. APLAD co-locates flow capture points with table
servers to limit the data collection overhead. All the tenants'
diagnosis queries run on the distributed table servers.  To support
diagnosis requests from many tenants, APLAD moves data across the
network only when a query for that data is submitted.

Our design of APLAD leverages recent advances in software defined
networking to help meet the requirements of maintaining the abstract
view, ensuring low data gathering overhead and isolation. By carefully
choosing how and where data collection and data aggregation happens,
APLAD is designed to scale to many tenants. APLAD is a significant
improvement over existing proposals for enterprise network diagnosis,
such as NDB~\cite{ndb}, OFRewind~\cite{ofrewind},
Anteater~\cite{anteater} and HSA~\cite{hsa}, which expose all the raw
network information. This leads to obvious scale issues, but it also
weakens isolation across tenants and exposes crucial information about
the infrastructure that may open the provider to attack.

We show that several typical network diagnosis use cases can be easily
implemented using the query interface, including throughput, RTT and
packet loss monitoring.  We demonstrate how APLAD can help to detect and
scale the bottleneck middlebox in a virtual network.
Our evaluation shows that the data collection can be
performed on hypervisor virtual switches without impacting 
existing user traffic, and the queries can be executed quickly on
distributed table servers. For example, throughput, RTT and packet loss
can be monitored in real time for a flow with several Gbps throughput.
We believe our work demonstrates the feasibility of providing 
a virtual network diagnostic service in a cloud.



